Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
24,696 exploits
Referência✓ VexDay Proof
FOSS Gallery Public 1.0 - Arbitrary File Upload
CVE-2008-4509—webappsphp
Unrestricted file upload vulnerability in processFiles.php in FOSS Gallery Admin and FOSS Gallery Public 1.0 beta allows
23RISK
open ↗
Referência✓ VexDay Proof
FOSS Gallery Admin 1.0 - Arbitrary File Upload
CVE-2008-4509—webappsphp
Unrestricted file upload vulnerability in processFiles.php in FOSS Gallery Admin and FOSS Gallery Public 1.0 beta allows
23RISK
open ↗
Referência✓ VexDay Proof
AJ Article 1.0 - Remote Authentication Bypass
CVE-2008-7051—webappsphp
AJ Square AJ Article allows remote attackers to bypass authentication and access administrator functionality via a direc
23RISK
open ↗
Referência✓ VexDay Proof
PHP Live Helper 2.0 - 'abs_path' Remote File Inclusion
CVE-2006-4051—webappsphp
PHP remote file inclusion vulnerability in global.php in Turnkey Web Tools PHP Live Helper 2.0 and earlier allows remote
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke Modules Manuales 0.1 - 'cid' SQL Injection
CVE-2008-0922—webappsphp
SQL injection vulnerability in the Manuales 0.1 module for PHP-Nuke allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
TorrentTrader Classic 1.09 - Multiple Vulnerabilities
CVE-2009-2157—webappsphp
Multiple SQL injection vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
Aria 0.99-6 - 'page' Local File Inclusion
CVE-2008-0332—webappsphp
Directory traversal vulnerability in arias/help/effect.php in aria 0.99-6 allows remote attackers to include and execute
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft DNS Server - Dynamic DNS Update/Change
CVE-2007-1644—remotewindows
The dynamic DNS update mechanism in the DNS Server service on Microsoft Windows does not properly authenticate clients i
35RISK
open ↗
Referência✓ VexDay Proof
ASPThai.Net Forum 8.5 - Remote Database Disclosure
CVE-2008-6872—webappsasp
ASPThai.NET ASPThai Forums 8.5 stores sensitive information under the web root with insufficient access control, which a
23RISK
open ↗
Referência✓ VexDay Proof
mailwatch 1.0.4 - 'doc' Local File Inclusion
CVE-2008-5991—webappsphp
Directory traversal vulnerability in docs.php in MailWatch for MailScanner 1.0.4 and earlier allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
MojoJobs - Blind SQL Injection
CVE-2008-3267—webappscgi
SQL injection vulnerability in mojoJobs.cgi in MojoJobs allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Referência✓ VexDay Proof
PHP Live Helper 2.0.1 - Multiple Vulnerabilities
CVE-2008-3764—webappsphp
Eval injection vulnerability in globalsoff.php in Turnkey PHP Live Helper 2.0.1 and earlier allows remote attackers to e
23RISK
open ↗
Referência✓ VexDay Proof
k-rate - SQL Injection / Cross-Site Scripting
CVE-2008-7097—webappsphp
Multiple SQL injection vulnerabilities in Qsoft K-Rate Premium allow remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
awzMB 4.2 Beta 1 - Multiple Remote File Inclusions
CVE-2007-5592—webappsphp
Multiple PHP remote file inclusion vulnerabilities in awzMB 4.2 beta 1 and earlier allow remote attackers to execute arb
28RISK
open ↗
Referência✓ VexDay Proof
ActualAnalyzer Lite (free) 2.78 - Local File Inclusion
CVE-2008-2076—webappsphp
Directory traversal vulnerability in admin.php in ActualScripts ActualAnalyzer Lite 2.78 allows remote attackers to incl
23RISK
open ↗
Referência✓ VexDay Proof
Motorola Timbuktu Pro 8.6.5/8.7 - Directory Traversal / Log Injection
CVE-2008-1117—remotewindows
Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu P
50RISK
open ↗
Referência✓ VexDay Proof
Simple Machines Forum (SMF) 1.1.3 - Blind SQL Injection
CVE-2007-5646—webappsphp
SQL injection vulnerability in Sources/Search.php in Simple Machines Forum (SMF) 1.1.3, when MySQL 5 is used, allows rem
23RISK
open ↗
Referência✓ VexDay Proof
BMForum 5.6 - 'tagname' SQL Injection
CVE-2008-6091—webappsphp
SQL injection vulnerability in plugins.php in BMForum 5.6, when magic_quotes_gpc is disabled, allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Groone's GLink ORGanizer 2.1 - 'cat' Blind SQL Injection
CVE-2009-0299—webappsphp
SQL injection vulnerability in index.php in Groone GLinks 2.1 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
32bit FTP (09.04.24) - 'Banner' Remote Buffer Overflow
CVE-2009-1592—remotewindows_x86
Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a
23RISK
open ↗
Referência✓ VexDay Proof
ClickAuction - Authentication Bypass
CVE-2009-0297—webappsphp
SQL injection vulnerability in login_check.asp in ClickAuction allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
PNPHPBB2 < 1.2 - 'index.php' SQL Injection
CVE-2007-3052—webappsphp
SQL injection vulnerability in index.php in the PNphpBB2 1.2i and earlier module for PostNuke allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
OpenGoo 1.1 - Local File Inclusion
CVE-2009-0286—webappsphp
Directory traversal vulnerability in upgrade/index.php in OpenGoo 1.1, when register_globals is enabled and magic_quotes
23RISK
open ↗
Referência✓ VexDay Proof
JW Player - 'playerready' Cross-Site Scripting
CVE-2012-3351—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in LongTail Video JW Player through 5.10.2295 allow remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
phpscripts Ranking Script - Insecure Cookie Handling
CVE-2008-6092—webappsphp
phpscripts Ranking Script allows remote attackers to bypass authentication and gain administrative access by sending an
23RISK
open ↗
Referência✓ VexDay Proof
ASP Portal - Multiple SQL Injections
CVE-2008-5605—webappsasp
Multiple SQL injection vulnerabilities in ASP Portal allow remote attackers to execute arbitrary SQL commands via the (1
23RISK
open ↗
Referência✓ VexDay Proof
7Shop 1.1 - Arbitrary File Upload
CVE-2008-6806—webappsphp
Unrestricted file upload vulnerability in includes/imageupload.php in 7Shop 1.1 and earlier allows remote attackers to e
23RISK
open ↗
Referência✓ VexDay Proof
PHP 4.4.6/5.2.1 - ext/gd Already Freed Resources Usage
CVE-2007-1582—locallinux
The resource system in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows context-dependent attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
Campsite 3.3.0 RC1 - Multiple Remote File Inclusions
CVE-2009-2183—webappsphp
Directory traversal vulnerability in admin-files/ad.php in Campsite 3.3.0 RC1 allows remote attackers to read and possib
23RISK
open ↗
Referência✓ VexDay Proof
PHP123 Top Sites - 'category.php?cat' SQL Injection
CVE-2007-4054—webappsphp
SQL injection vulnerability in category.php in PHP123 Top Sites allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
← previouspage 814 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.